Certification:

 

GIAC Web Application Penetration Tester

GWAPT

---

View Professionals »

Target

Web applications one of the most significant points of vulnerability in organizations today. Most organizations have them (both web applications and the vulnerabilities associated with them). Web app holes have resulted in the theft of millions of credit cards, major financial loss, and damaged reputations for hundreds of enterprises. The number of computers compromised by visiting web sites altered by attackers is too high to count. This certification measures and individuals understanding of web application exploits and penetration testing methodology. Check your web applications for holes before the bad guys do.

Course

SEC542: Web App Penetration Testing and Ethical Hacking

*No Specific training is required for any GIAC certification. If candidates need help in mastering the objectives for this certification, there are many sources of information available. Practical experience is one option; there are also numerous books on the market covering Computer Information Security. Another option is SANS training, or any relevant courses from other training providers.*

Requirements

• 1 proctored exam
• 75 questions
• Time limit of 2 hours
• Minimum Passing Score of 70.7% (53 out of 75 questions)

NOTE:

GIAC reserves the right to change the specifications for each certification without notice. Based on a scientific passing point study, the GWAPT passing point changed from a 150 question format to a 75 question format for newly activated certification attempts on or after 4/11/2011. To verify the format of your current certification attempt, please read the Certification Information found in your portal account at https://exams.giac.org/pages/attempts.

Renew

Every 4 years

Delivery

NOTE: GIAC exams are NOT given the day after the conference ends.

Exams are delivered online through a standard web browser. For exams purchased with SANS training, access to the exam will be available 7-10 days following the end of the conference. Standalone challenge exams are issued within 24 hours upon receipt of payment. You will receive an email from GIAC when your exam has been issued to your portal account. You have 120 days to complete the exam from the time we send notice that it is available. The exams are proctored and should be scheduled using our proctored exam procedure.

Links

• SANS Information Security Reading Room
• Certified Professionals (GWAPT)
• Recertification
• Exam Feedback Procedure
• Grievance Procedure

Bulletin (Part 2 of Candidate Handbook)

The topic areas for each exam part follow:

Exam Certification Objectives	Certification Objective Outcome Statement
AJAX	The candidate will demonstrate an understanding of AJAX technology and its known weaknesses
Application Flow Charting and Session Analysis	The candidate will demonstrate an understanding of the techniques used to identify the logic flow of a web application.
Automated Web Application Vulnerability Scanners	The candidate will demonstrate familiarity with automated tools used to find web application vulnerabilities and their distinguishing features.
Client Authentication	The candidate will demonstrate familiarity with the major types of client authentication and associated strenthgs and weaknesses
Cross Site Scripting and Attack Frameworks	The candidate will demonstrate an understanding of the types of XSS attacks and XSS attack frameworks that can be utilized during a pen test
Flash	The candidate will demonstrate comprehension of Flash technology and its weaknesses
Mapping and Probing	The candidate will demonstrate an understanding of port scanning, OS fingerprinting, Version Scanning , and banner grabbing.
Programming Fundamentals	The candidate will demonstrate familiarity with modern web-based languages including Javascript with Ajax, Java Applets, PHP, and Python
Recon Using Public Information	The candidate will demonstrate comprehension of techniques used to conduct reconnaissance using publicly available information.
Session Tracking and SSL	The candidate will demonstrate comprehension of session tracking and SSL/TLS use in modern web communications as well as the attacks that can leverage flaws in session state
Spidering	The candidate will demonstrate mastery of techniques that can be used to spider a site.
SQL Injection	The candidate will demonstrate an understanding of how to perform SQL injection attacks and how to identify SQL injection vulnerabilities in applications
Understanding the Web and HTTP	The candidate will demonstrate an understanding of the fundamentals web applications and their architecture and a thorough comprehension of the HTTP protocol
Web App Pen Test Methodology and Reporting	The candidate will demonstrate comprehension of the typical methods and components used during a web application penetration test
Web Application Vulnerabilities and Manual Verification Techniques	The candidate will demonstrate the ability to test for common web application vulnerabilities using a combination of manual techniques and tools.
Web Services	The candidate will demonstrate familiarity with web service technologies and attack vectors

Where to Get Help

Training is available from a variety of resources including on line, course attendance at a live conference, and self study.

Practical experience is another way to ensure that you have mastered the skills necessary for certification. Many professionals have the experience to meet the certification objectives identified.

Finally, college level courses or study through another program may meet the needs for mastery.

The procedure to contest exam results can be found at http://www.giac.org/about/procedures/grievance.